Updated October 2026 to our current guidance. The original reporting date is unchanged.
On July 1, new state privacy laws took effect in Connecticut, Arkansas, and Utah. The old answer, “we’re too small to worry,” stopped working that day. Here’s what the new laws cover and the first steps you can take today.
See the Three Steps ↓Plain English. Your attorney handles the legal wording.
Picture a small law firm. Three lawyers, one office manager, a client list they are proud of. For years privacy laws were reasonably a big-company concern, and their size kept them out. On July 1 the line moved, and businesses their size are now inside it.
Most of this is plainer than the legal talk makes it sound. By the end you will know who the new state privacy laws now cover, the one habit they all point to, and three things you can start today.
In this article
Three states switched on new rules the same day. Connecticut is the big one. Arkansas and Utah are narrower, but they matter too. Together, the new state privacy laws moved the line on who has to pay attention.
Connecticut updated its Data Privacy Act (the change is called SB 1295). The old rule covered businesses that handled the personal information of 100,000 people. The new line drops to 35,000. That alone sweeps in a lot of smaller firms. The size test also goes away entirely if a business sells personal data, or if it holds “sensitive data.” Connecticut’s attorney general enforces all of it.
Arkansas passed a children’s and teens’ online privacy law (HB 1717). It requires a parent’s consent for kids 12 and under. For ages 13 to 16, the teen or a parent can consent. Targeted ads aimed at minors are not allowed. Utah (HB 418) added data-portability rights, mostly around social media, so people can move their data from one platform to another.
Two phrases in the Connecticut law do the heavy lifting, and both catch owners who assumed they were too small to be covered. Here they are in plain terms.
“Sells personal data” is broader than it sounds. It means sharing personal data for value of any kind, not only trading names for cash. Send your customer list to a marketing partner? Let an ad tool track your website visitors? That can count. Plenty of small firms “sell” data without ever thinking they did.
“Sensitive data” removes the size exemption. If you hold any of it, the 35,000 line no longer applies to you. Sensitive data now includes Social Security numbers, financial account information, biometric or genetic data, and even “neural data.” A law office holds Social Security numbers. A financial planner holds account information. A clinic holds both. Hold any, and you are in.
There is a new AI-training duty, too. If a business feeds personal data into training an AI tool, it now has to disclose that. In plain terms: if you pour customer information into some new AI helper, you have to say so.
So the small healthcare, law, or financial firm that sat outside the old 100,000 line is inside at 35,000, and often inside no matter the count.
I won’t pretend to be your lawyer. The legal fine print needs a real attorney, and you should call yours. What I can help with is the tech side: knowing what personal data you actually hold, and where it sits.
Read the new state privacy laws back to back, and one thing sits under all of them. You have to know what personal data you hold, and where it goes. A privacy notice has to describe it honestly. An opt-out has to actually let people say no. Neither is possible if you have never mapped your own data.
Most small firms have data spread around. A spreadsheet on one laptop. A cloud folder nobody cleaned up. An old marketing tool still holding a list. You can’t write a truthful privacy notice about data you forgot you had, so the list comes first.
You don’t need a lawyer to start these. They are the floor everything else stands on.
Ask three plain questions. Do you touch the personal data of 35,000 people or more? Do you share data with any marketing or ad partner? Do you hold Social Security numbers, account details, or health data? A yes to any one likely puts you under the new state privacy laws. Write the answers down.
Have someone read your public privacy notice against what you actually do. They should match. If people can ask you to stop selling or sharing their data, the opt-out has to work and be easy to find. Your attorney checks the legal wording. You make sure it tells the truth.
Make a simple list. What personal data do you keep, on which machines, in which apps, and who else touches it? This is the step almost everyone skips, and it is the one every rule circles.
While you are listing the machines that hold personal data, it is worth knowing what else is on them. That’s a separate count, and it’s below.
You started your business to serve clients, not to become a privacy officer. Feeling behind on this is normal.
I learned this one up close. My own dad fell for a phishing email, and I have spent my life in this work. Scammers got remote access to his computer and went hunting for his financial documents. My step-mother noticed something was off. I jumped in from across the country and stopped them before they reached his bank logins.
I have spent 35+ years in cybersecurity. FBI InfraGard trainer. Dozens of managed clients since 1991. None has had ransomware. The lesson I keep seeing: the data you forgot about is the data nobody is looking after.
Your data map tells you which computers hold personal information. It doesn’t tell you whether the software on those computers is current. Windows Update never touches third-party software, so the PDF reader, the accounting add-on, and the old tools on the machine with the client files update on their own schedule, or not at all.
So who has been checking those? Before you look, guess how many programs are on the computer that holds your client files. Then count them. The Reveal Scan gives you two numbers for each Windows PC: how many programs are current and how many need updating. It doesn’t look for personal data; that list is yours. If the second number surprises you, that’s common. You don’t have to be able to do this. We’ll do it with you.
Two reasons. First, state privacy laws spread. What one state requires this year tends to become the pattern others copy next. Second, if you hold data on anyone who lives in one of these states, their state’s rules can reach you.
If what you hold is already tidy, the list will take an afternoon and tell you so.
The Reveal Scan counts what is installed on each Windows PC: how many programs are current and how many need updating. About ten minutes, read-only, no credit card needed.
Count What’s on Your Computers →The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.
If you run it and never speak to us again, that’s a fine outcome.
Want this kind of plain-English security news every week? Sign up for Craig’s Insider Notes at CraigPeterson.com.
Join the owners who get Craig's Insider Notes every week.